Announcement

Privacy Commissioner initiates investigations into breach impacting federal government personnel who used relocation services

The Privacy Commissioner of Canada has decided to launch investigations into a cyberattack that has resulted in a breach affecting the personal information of federal government personnel who used government-contracted relocation services over the past 24 years.

The breach involves personal information that was held by Brookfield Global Relocation Services (BGRS) and Sirva Canada LP, affiliated companies that are contracted by the Government of Canada to provide relocation services for employees.

A message from the Treasury Board Secretariat (TBS) indicates that those affected include current and former Government of Canada employees, members of the Canadian Armed Forces and Royal Canadian Mounted Police personnel. TBS has said that the breach could involve the personal and financial information of anyone who used the relocation services as far back as 1999. The number of individuals affected is not known. TBS has indicated that the Government of Canada is taking a proactive, precautionary approach to support those potentially affected.

“Given the broad scope and potentially sensitive nature of the compromised personal information, I have determined that this breach must be investigated so that we can understand why this happened and what must be done to remedy the situation and prevent such things from happening again,” said Privacy Commissioner of Canada Philippe Dufresne. “I appreciate and encourage any and all remedial steps that are being taken and will be taken to protect those affected.”

The investigations will examine the adequacy of the safeguards that the two companies and the federal government had in place to protect the personal information of personnel who used relocation services.

The Office of the Privacy Commissioner (OPC) will assess compliance with the Privacy Act, the federal public sector privacy law, by Public Services and Procurement Canada and TBS, the two government departments that contracted with the companies.

It will also assess compliance with the Personal Information Protection and Electronic Documents Act or PIPEDA, Canada’s federal private sector law by BGRS, a relocation management company, and Sirva, a household goods transportation company that contracted with government departments.